From c5cf384f9a79fc99126aeb45067d1c50538e5b87 Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 23:47:20 +0200
Subject: [PATCH] test(deploy): prove central workflow carries signed target

---
 tests/approved-deployment-evidence.test.mjs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/approved-deployment-evidence.test.mjs b/tests/approved-deployment-evidence.test.mjs
index 0b1650c..67ebc46 100644
--- a/tests/approved-deployment-evidence.test.mjs
+++ b/tests/approved-deployment-evidence.test.mjs
@@ -6,10 +6,11 @@ const workflowUrl = new URL('../examples/gitea-actions/forgeflow-approved-deploy
 const deployUrl = new URL('../examples/server/forgeflow-deploy', import.meta.url);
 
 
-test('approved workflow transports immutable evidence only to the root-owned deploy wrapper', async () => {
+test('central approved workflow transports signed target evidence only to the root-owned deploy wrapper', async () => {
   const workflow = await readFile(workflowUrl, 'utf8');
 
   for (const input of [
+    'repository',
     'environment',
     'commit_sha',
     'request_id',
@@ -20,7 +21,8 @@ test('approved workflow transports immutable evidence only to the root-owned dep
   ]) {
     assert.match(workflow, new RegExp(`\\b${input}:`));
   }
-  assert.match(workflow, /\$\{\{ gitea\.repository \}\}/);
+  assert.match(workflow, /\$\{\{ inputs\.repository \}\}/);
+  assert.doesNotMatch(workflow, /\$\{\{ gitea\.repository \}\}/);
   assert.match(workflow, /FF_APPROVAL_ID.*FF_REQUEST_ID/s);
   assert.match(workflow, /sudo \/usr\/local\/bin\/forgeflow-deploy/);
   assert.doesNotMatch(workflow, /actions\/checkout/);